Token processing with selective de-tokenization for proximity based access device interactions

ABSTRACT

A method includes providing an initial communication, by an access device to a user device. The access device can receive the user identifier and the access token and receive a secret associated with the user. The access device can determine, using the user identifier and/or the access token, if the transaction is authorized by an authorizing entity computer associated with the access device or by an authorizing entity not associated with the access device. If the transaction is authorized by the authorizing entity computer associated with the access device, the access device can transmit an authorization request message comprising the user identifier, the secret, and the access token to the authorizing entity computer. The authorizing entity computer validates the secret, retrieves a real credential of the user using the user identifier, and authorizes the transaction.

BACKGROUND

Users can initiate interactions with access devices (e.g., ATMs) with apayment card. The user can initiate an interaction with an access deviceusing a payment card that is associated with a particular authorizingentity computer. Upon reading the payment card, the access device canprompt the user to input a PIN. The access device can send a messagewith the user's account number and the PIN (e.g., in a PIN block) to anATM controller (ATMC).

An ATM controller (ATMC) is a system used to route transactions betweenATMs, core banking systems and other banks. An ATMC can be referred toas an switch. A message may enter an ATMC from an ATM, another ATMC, ora third party. When receiving a message, the ATMC will examine themessage, validate a PIN block if present, and then route the messageaccording to the leading digits of the account number referenced.

The routed message can be sent to a core banking system to check theavailable balances and to authorize the transaction, or sent to anotherbank's ATMC. For example, if a customer of Bank A used their card at anATM belonging to Bank B, the message would be forwarded to Bank B'sATMC. The ATMC would examine the message, and based upon the accountnumber determine that the appropriate ATMC to contact would be Bank A.It would then forward the message to Bank A's ATMC for authorization.

Embodiments of the disclosure address this problem and other problemsindividually and collectively.

SUMMARY

Embodiments are related to methods and systems for selective tokenprocessing based access device interactions.

One embodiment is related to a method comprising: providing, by anaccess device to a user device associated with a user in a transaction,an initial communication; receiving, by the access device from the userdevice, a user identifier and an access token; receiving, by the accessdevice, a secret associated with the user; determining, by the accessdevice, using the user identifier and/or the access token, if thetransaction is authorized by an authorizing entity computer associatedwith the access device or by an authorizing entity not associated withthe access device; if the transaction is authorized by the authorizingentity computer associated with the access device, then transmitting anauthorization request message comprising the user identifier, thesecret, and the access token to the authorizing entity computer, whereinthe authorizing entity computer validates the secret, retrieves a realcredential of the user using the user identifier, and authorizes thetransaction; and if the transaction is not associated with theauthorizing entity computer, then transmitting the authorization requestmessage comprising the user identifier, the secret, and the access tokento a token service computer, wherein the token service computerdetokenizes the access token to obtain the real credential replaces theaccess token with the real credential in the authorization requestmessage to form a modified authorization request message, and forwardsthe modified authorization request message to another authorizing entitycomputer for authorization.

Another embodiment is related to an access device comprising: aprocessor; and a computer-readable medium coupled to the processor, thecomputer-readable medium comprising code executable by the processor forimplementing a method comprising: providing, to a user device associatedwith a user in a transaction, an initial communication; receiving, bythe access device from the user device, a user identifier and an accesstoken; receiving a secret associated with the user; determining usingthe user identifier and/or the access token, if the transaction isauthorized by an authorizing entity computer associated with the accessdevice or by an authorizing entity not associated with the accessdevice; if the transaction is authorized by the authorizing entitycomputer associated with the access device, then transmitting anauthorization request message comprising the user identifier, thesecret, and the access token to the authorizing entity computer, whereinthe authorizing entity computer validates the secret, retrieves a realcredential of the user using the user identifier, and authorizes thetransaction; and if the transaction is not associated with theauthorizing entity computer, then transmitting the authorization requestmessage comprising the user identifier, the secret, and the access tokento a token service computer, wherein the token service computerdetokenizes the access token to obtain the real credential, replaces theaccess token with the real credential in the authorization requestmessage to form a modified authorization request message, and forwardsthe modified authorization request message to another authorizing entitycomputer for authorization.

Another embodiment is related to a method comprising: receiving, by anauthorizing entity computer, an authorization request message comprisinga user identifier, a secret, and an access token from an access devicein communication with a user device associated with a user during atransaction, wherein the transaction was determined by the access deviceto be authorized by the authorizing entity computer associated with theaccess device, wherein the authorizing entity computer is associatedwith the access device; validating, by the authorizing entity computer,the secret, retrieving, by the authorizing entity computer, a realcredential of the user using the user identifier; authorizing, by theauthorizing entity computer, the transaction based on whether or not thesecret is validated and/or whether or not the real credential isretrieved; generating, by the authorizing entity computer, anauthorization response message including an indication of whether or notthe transaction is authorized and the access token; and providing, bythe authorizing entity computer, the authorization response message tothe access device.

Further details regarding embodiments of the disclosure can be found inthe Detailed Description and the Figures.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a block diagram of an interaction processing systemaccording to embodiments.

FIG. 2 shows a block diagram of components of an access device accordingto embodiments.

FIG. 3 shows a flow diagram illustrating a provisioning processaccording to embodiments.

FIG. 4 shows a flowchart illustrating an authorization process accordingto embodiments.

FIG. 5 shows a flowchart illustrating a device communication methodaccording to embodiments.

DETAILED DESCRIPTION

Prior to discussing embodiments of the disclosure, some terms can bedescribed in further detail.

A “user” may include an individual. In some embodiments, a user may beassociated with one or more personal accounts and/or mobile devices. Theuser may also be referred to as a cardholder, account holder, orconsumer in some embodiments.

A “user device” may be a device that is operated by a user. Examples ofuser devices may include a mobile phone, a smart phone, a card, apersonal digital assistant (PDA), a laptop computer, a desktop computer,a server computer, a vehicle such as an automobile, a thin-clientdevice, a tablet PC, etc. Additionally, user devices may be any type ofwearable technology device, such as a watch, earpiece, glasses, etc. Theuser device may include one or more processors capable of processinguser input. The user device may also include one or more input sensorsfor receiving user input. As is known in the art, there are a variety ofinput sensors capable of detecting user input, such as accelerometers,cameras, microphones, etc. The user input obtained by the input sensorsmay be from a variety of data input types, including, but not limitedto, audio data, visual data, or biometric data. The user device maycomprise any electronic device that may be operated by a user, which mayalso provide remote communication capabilities to a network. Examples ofremote communication capabilities include using a mobile phone(wireless) network, wireless data network (e.g., 3G, 4G or similarnetworks), Wi-Fi, Wi-Max, or any other communication medium that mayprovide access to a network such as the Internet or a private network.

A “user identifier” can include any piece of data that can identify auser. A user identifier can comprise any suitable alphanumeric string ofcharacters. In some embodiments, the user identifier may be derived fromuser identifying information. A user identifier can be a userinformation file identifier, also referred to as a customer informationfile identifier (CIF ID). In some embodiments, a user identifier can bea payment account reference (PAR) value when the value is associatedwith the user rather than a single account.

A “user information file” can be an electronic file that can storespertinent information about a user. A user information file can beassociated with a user information file identifier (e.g., a useridentifier). In some embodiments, a user information file can include auser's personal information and/or a user's account information. Forexample, a user information file at a bank might include a user's creditrelationships, accounts owned, and ownership information.

An “access device” may be any suitable device that provides access to aremote system. An access device may also be used for communicating witha coordination computer, a communication network, or any other suitablesystem. An access device may generally be located in any suitablelocation, such as at the location of a merchant. An access device may bein any suitable form. Some examples of access devices include POS orpoint of sale devices (e.g., POS terminals), cellular phones, personaldigital assistants (PDAs), personal computers (PCs), tablet PCs,hand-held specialized readers, set-top boxes, electronic cash registers(ECRs), vending machines, automated teller machines (ATMs), virtual cashregisters (VCRs), kiosks, security systems, access systems, and thelike.

An access device may use any suitable contact or contactless mode ofoperation to send or receive data from, or associated with, a mobilecommunication or payment device. For example, access devices can havecard readers that can include electrical contacts, radio frequency (RF)antennas, optical scanners, bar code readers, or magnetic stripe readersto interact with portable devices such as payment cards.

“Credentials” may comprise any evidence of authority, rights, orentitlement to privileges. For example, access credentials may comprisepermissions to access certain tangible or intangible assets, such as abuilding or a file. Examples of credentials may include passwords,passcodes, or secret messages. In another example, payment credentialsmay include any suitable information associated with and/or identifyingan account (e.g., a payment account and/or payment device associatedwith the account). Such information may be directly related to theaccount or may be derived from information related to the account.Examples of account information may include an “account identifier” suchas a PAN (primary account number or “account number”), a token, asubtoken, a gift card number or code, a prepaid card number or code, auser name, an expiration date, a CVV (card verification value), a dCVV(dynamic card verification value), a CVV2 (card verification value 2), aCVC3 card verification value, etc. An example of a PAN is a 16-digitnumber, such as “4147 0900 0000 1234”. In some embodiments, credentialsmay be considered sensitive information.

A “token” may include a substitute value for a credential. A token maybe a string of numbers, letters, or any other suitable characters.Examples of tokens include payment tokens, access tokens, personalidentification tokens, etc.

An “payment token” may include an identifier for a payment account thatis a substitute for an account identifier, such as a PAN or IBAN. Forexample, a payment token may include a series of alphanumeric charactersthat may be used as a substitute for an original account identifier. Forexample, a token “4900 0000 0000 0001” may be used in place of a PAN“4147 0900 0000 1234.” In some embodiments, a payment token may beformat preserving and may have a numeric format that conforms to theaccount identifiers used in existing transaction processing networks(e.g., ISO 8583 financial transaction message format). In someembodiments, a payment token may be used in place of a PAN to initiate,authorize, settle or resolve a payment transaction or represent theoriginal credential in other systems where the original credential wouldtypically be provided. In some embodiments, a payment token may begenerated such that the recovery of the original PAN or other accountidentifier from the token value may not be computationally derived.Further, in some embodiments, the token format may be configured toallow the entity receiving the token to identify it as a token andrecognize the entity that issued the token.

“Tokenization” can include a process by which data is replaced withsubstitute data. For example, a payment account identifier (e.g., aprimary account number (PAN)) may be tokenized by replacing the primaryaccount identifier with a substitute number (e.g. a token) that may beassociated with the payment account identifier. Further, tokenizationmay be applied to any other information that may be replaced with asubstitute value (i.e., token). Tokenization enhances transactionefficiency and security.

A “cryptogram” may include a piece of obscured text such as encryptedtext. A cryptogram may be formed by encrypting input data with anencryption key such as a symmetric encryption key. In some embodiments,a cryptogram is reversible so that the inputs that are used to form thecryptogram can be obtained using the same symmetric key to perform adecryption process. In some embodiments, if input data is encryptedusing a private key of a public/private key pair, the cryptogram mayalso be a digital signature. A digital signature may be verified with apublic key of the public/private key pair. In some embodiments, acryptogram may include a dCVV (dynamic card verification value).

In embodiments of the invention, a cryptogram can be generated in anysuitable manner. In some embodiments, the input to the cryptogram caninclude data elements including an account identifier such as primaryaccount number, and a variable data element such as a counter, a time ofday, or interaction value. Such data may be included using an encryptionprocess such as DES, triple DES, or AES using any suitable encryptionkeys. The encryption keys may also be UDKs or unique derived keys, andmay be generated based upon device specific information such as anaccount number, which may be encrypted using a master derivation key(MDK). The cryptogram can be verified by another computer such a remotecomputer by either decrypting the cryptogram to and verifying thedecrypted contents with other data (e.g., an account number stored onfile), or by encrypting other inputs and then comparing the encryptedresult to the cryptogram.

A “secret” can include something that is kept or meant to be keptunknown or unseen by others. A secret can be known by a user of a userdevice as well as by a authorizing entity of an authorizing entitycomputer. For example, a secret can be a personal identification number(PIN). In some embodiments, a secret can be created by a user andprovided to an authorizing entity computer during provisioning and/orenrollment by the user to obtain a real credential. In otherembodiments, a secret can be created by an authorizing entity computerand then assigned and provided to the user. In some embodiments, asecret can include a one-time password (OTP).

An “authorization request message” may be an electronic message thatrequests authorization for an interaction. In some embodiments, it issent to a transaction processing computer and/or an issuer of a paymentcard to request authorization for a transaction. An authorizationrequest message according to some embodiments may comply withInternational Organization for Standardization (ISO) 8583, which is astandard for systems that exchange electronic transaction informationassociated with a payment made by a user using a payment device orpayment account. The authorization request message may include an issueraccount identifier that may be associated with a payment device orpayment account. An authorization request message may also compriseadditional data elements corresponding to “identification information”including, by way of example only: a service code, a CVV (cardverification value), a dCVV (dynamic card verification value), a PAN(primary account number or “account number”), an access token, a username, an expiration date, etc. An authorization request message may alsocomprise “transaction information,” such as any information associatedwith a current transaction, such as the transaction value, merchantidentifier, merchant location, acquirer bank identification number(BIN), card acceptor ID, information identifying items being purchased,etc., as well as any other information that may be utilized indetermining whether to identify and/or authorize a transaction.

An “authorization response message” may be a message that responds to anauthorization request. In some cases, it may be an electronic messagereply to an authorization request message generated by an issuingfinancial institution or a transaction processing computer. Theauthorization response message may include, by way of example only, oneor more of the following status indicators: Approval—transaction wasapproved; Decline—transaction was not approved; or Call Center—responsepending more information, merchant must call the toll-free authorizationphone number. The authorization response message may also include anauthorization code, which may be a code that a credit card issuing bankreturns in response to an authorization request message in an electronicmessage (either directly or through the transaction processing computer)to the merchant's access device (e.g., POS equipment) that indicatesapproval of the transaction. The code may serve as proof ofauthorization.

An “authorizing entity” may be an entity that authorizes a request.Examples of an authorizing entity may be an issuer, a governmentalagency, a document repository, an access administrator, etc. Anauthorizing entity may operate an authorizing entity computer. An“issuer” may refer to a business entity (e.g., a bank) that issues andoptionally maintains an account for a user. An issuer may also issuepayment credentials stored on a user device, such as a cellulartelephone, smart card, tablet, or laptop to the consumer, or in someembodiments, a portable device.

An “interaction” may include a reciprocal action or influence. Aninteraction can include a communication, contact, or exchange betweenparties, devices, and/or entities. Example interactions include atransaction between two parties and a data exchange between two devices.In some embodiments, an interaction can include a user requesting accessto secure data, a secure webpage, a secure location, and the like. Inother embodiments, an interaction can include a payment transaction inwhich two devices can interact to facilitate a payment.

“Interaction data” can include data related to and/or recorded during aninteraction. In some embodiments, interaction data can be transactiondata of the network data. Transaction data can comprise a plurality ofdata elements with data values.

A “resource provider” may be an entity that can provide a resource suchas goods, services, information, and/or access. Examples of resourceproviders includes merchants, data providers, transit agencies,governmental entities, venue and dwelling operators, etc.

The term “verification” and its derivatives may refer to a process thatutilizes information to determine whether an underlying subject is validunder a given set of circumstances. Verification may include anycomparison of information to ensure some data or information is correct,valid, accurate, legitimate, and/or in good standing.

A “processor” may include a device that processes something. In someembodiments, a processor can include any suitable data computationdevice or devices. A processor may comprise one or more microprocessorsworking together to accomplish a desired function. The processor mayinclude a CPU comprising at least one high-speed data processor adequateto execute program components for executing user and/or system-generatedrequests. The CPU may be a microprocessor such as AMD's Athlon, Duronand/or Opteron; IBM and/or Motorola's PowerPC; IBM's and Sony's Cellprocessor; Intel's Celeron, Itanium, Pentium, Xeon, and/or XScale;and/or the like processor(s).

A “memory” may be any suitable device or devices that can storeelectronic data. A suitable memory may comprise a non-transitorycomputer readable medium that stores instructions that can be executedby a processor to implement a desired method. Examples of memories maycomprise one or more memory chips, disk drives, etc. Such memories mayoperate using any suitable electrical, optical, and/or magnetic mode ofoperation.

A “server computer” may include a powerful computer or cluster ofcomputers. For example, the server computer can be a large mainframe, aminicomputer cluster, or a group of servers functioning as a unit. Inone example, the server computer may be a database server coupled to aWeb server. The server computer may comprise one or more computationalapparatuses and may use any of a variety of computing structures,arrangements, and compilations for servicing the requests from one ormore client computers.

I. Introduction

Current, network based tokenization was designed for access device(e.g., point-of-sale (POS) device) environments and does currentlyenable closed loop or “on-us” access device services nor access deviceaccess to secondary accounts. A closed loop or “on-us” service is aservice that can be provided in the network of the access device, whilean open loop or “off-us” service is a service that is provided by anauthorizing entity computer in a different network than the network usedby the access device. Closed loop or on-us transactions cannot usetokens in conventional systems, because the de-tokenization process thatis performed on tokens is performed by a computer that is outside of thenetwork containing the access device. These current limitations canrequire that authorizing entities do not enable access devices toperform proximity based on-us interactions with user devices (e.g.,mobile devices) that contain tokens. Or, authorizing entities may enableaccess devices to communicate with user devices with tokens, but mayrequire extensive message routing outside of the access device's networkand back, thereby significantly increasing transaction times.

Embodiments of the disclosure allow for an access device that canefficiently perform an interaction with a user device containing anaccess token and associated with a user. For example, an access devicecan provide an initial communication to the user device, in response towhich the user device can retrieve a user identifier and an access tokenfrom a memory. The user device can provide the user identifier and theaccess token to the access device. The access device can then, in someembodiments, prompt the user to input a secret associated with the user.

In various embodiments, an access token can be associated with the useridentifier established by an authorizing entity computer. In someembodiments, the user identifier can be, for example, a consumerinformation file identifier (CIF ID). The user identifier can be storedin a tag (e.g., tag 9F10 (IAD)) provided to the access device. Theaccess device can read provisioned AID's on the user device and thendetermine authorizing entity created BINs (bank identification numbers)or assigned token ranges.

The access device can then determine if the transaction is authorizedby 1) an authorizing entity computer associated with the access device(e.g., an on-us interaction) or by 2) an authorizing entity notassociated with the access device (e.g., a not-on-us interaction). Forexample, the access device can determine the authorizing entity computerusing the user identifier and/or the access token.

If the transaction is authorized by the authorizing entity computerassociated with the access device, then the access device can transmitan authorization request message comprising the user identifier, thesecret, and the access token to the authorizing entity computer. Uponreceiving the authorization request message, the authorizing entitycomputer can validate the secret, retrieve a real credential of the userusing the user identifier, and authorize the transaction. In someembodiments, the authorizing entity computer can determine if the realcredential of the user is associated with the access token. In someembodiments, the user identifier may be encrypted such that theauthorizing entity computer can identify and/or gain access to aplaintext user identifier.

In some embodiments, the authorizing entity computer can validate thesecret by comparing the received secret to a previously stored secretassociated with the real credential. For example, the previously storedsecret can be a PIN created by the user of the real credential.

In some embodiments, the user identifier can be read, by the accessdevice, from a first tag (e.g., 9F10) as well as, in some embodiments,the last 4 digits of a second tag (e.g., tag 9F19), to determine whichaccount selection and service features to display to the user on theaccess device after authorization by the authorizing entity computer.

If the transaction is not associated with the authorizing entitycomputer, then the access device can transmit the authorization requestmessage comprising the user identifier, the secret, and the access tokento a token service computer. The token service computer can detokenizethe access token to obtain the real credential. The token servicecomputer can then replace the access token with the real credential inthe authorization request message to form a modified authorizationrequest message and then forward the modified authorization requestmessage to another authorizing entity computer for authorization.

Various embodiments can facilitate both on-us and not-on-us accessdevice processing. While not-on-us access device processing can utilizeaccess to designated primary accounts, on-us access device processingcan facilitates with access to both primary and secondary accountslinked to single user credential (e.g., a PAN).

II. Systems

FIG. 1 shows a system 100 according to embodiments of the disclosure.The system 100 comprises a user device 102, an access device 104, anaccess device network 106, an authorizing entity computer A 108, atransport computer 110, a processing network computer 112, a tokenservice computer 114, and a plurality of authorizing entity computers116. The user device 102 can be in operative communication with theaccess device 104. The access device 104 can be in operativecommunication with the access device network 106 and the transportcomputer 110. The access device network 106 can be in operativecommunication with the processing network computer 112 and theauthorizing entity computer A 108. The processing network computer 112can be in operative communication with the authorizing entity computer A108, the transport computer 110, and the token service computer 114, andthe plurality of authorizing entity computers 116.

For simplicity of illustration, a certain number of components are shownin FIG. 1. It is understood, however, that embodiments of the inventionmay include more than one of each component. In addition, someembodiments of the invention may include fewer than or greater than allof the components shown in FIG. 1.

Messages between at least the devices in the system 100 in FIG. 1 can betransmitted using a secure communications protocols such as, but notlimited to, File Transfer Protocol (FTP); HyperText Transfer Protocol(HTTP); Secure Hypertext Transfer Protocol (HTTPS), SSL, ISO (e.g., ISO8583) and/or the like. The communications network may include any oneand/or the combination of the following: a direct interconnection; theInternet; a Local Area Network (LAN); a Metropolitan Area Network (MAN);an Operating Missions as Nodes on the Internet (OMNI); a secured customconnection; a Wide Area Network (WAN); a wireless network (e.g.,employing protocols such as, but not limited to a Wireless ApplicationProtocol (WAP), I-mode, and/or the like); and/or the like. Thecommunications network can use any suitable communications protocol togenerate one or more secure communication channels. A communicationschannel may, in some instances, comprise a secure communication channel,which may be established in any known manner, such as through the use ofmutual authentication and a session key, and establishment of a SecureSocket Layer (SSL) session.

The user device 102 can include a device operated by a user. The userdevice 102 can include a digital wallet, in some embodiments, thatstores an access token. The user device 102 can be configured tocommunicate with one or more access devices (e.g., the access device104). The user device 102 can provide the access token and a useridentifier to the access device 104 during an interaction (e.g., apayment transaction, a location access interaction, a data accessinteraction, an account access interaction, etc.). In some embodiments,a user can perform any suitable interaction with the access device 104using the user device 102. For example, though an interaction a user canmake a deposit, access multiple accounts, purchase goods, anycombination thereof, etc.

The access device 104 can include a device that can, for example, readdata from the user device 102, determine an authorizing entity computerassociated with the access device 104 (e.g., the authorizing entitycomputer A 108) from a plurality of authorizing entity computers 116.The access device 104, in some embodiments, can be an automated tellermachine (ATM).

The access device 104 can be associated with an authorizing entitycomputer (e.g., the authorizing entity computer A 108). The accessdevice 104 and the authorizing entity computer A 108 can be associatedin any suitable manner. For example, the access device 104 and theauthorizing entity computer A 108 can be operated by the same entity(e.g., a bank, a security firm, a data providing entity, etc.). In someembodiments, the access device 104 can be associated with theauthorizing entity computer A 108 by being at, or pertaining to, a sameor similar location. For example, the access device 104 can be locatedat a secure building that users may access if they are associated withan access token for the secure building. The authorizing entity computerA 108 may also be associated with the secure building. For example, theauthorizing entity computer A 108 can be a computer located at thesecure building and may grant users access to the secure building (e.g.,authorize the users to enter the secure building).

The access device network 106 can include any suitable network that canallow the access device 104 to communicate with the authorizing entitycomputer A 108. The access device network 106 can comprise one or morecomputers that can route messages between the access device 104 and theauthorizing entity computer A 108. The access device network 106 canprocess transactions provided by the access device 104 in a mannerspecific to the access device 104. For example, the access devicenetwork 106 can be associated with the access device 104 (e.g., operatedby a same or similar entity, etc.). As such, the access device network106 can be configured to process data received from the access device104 that is associated with the real credentials issued to the user. Theaccess device 104 can present additional options (e.g., deposit cash,deposit checks, etc.) to the user when the user's real credentials andthe access device 104 are associated with a same issuing entity. Theuser can select an option that might otherwise not be present if theuser's real credentials and the access device 104 are not associated.The access device network 106 can be configured to process these optionsthat are available to the user, whereas if the user's real credentialsare associated with a different issuing entity, then the access devicenetwork 106 may not be configured to process data relating to the realcredentials (or access token associated therewith). In such a case, theaccess device network 106 can send any relevant data to a differentaccess device network that is associated with the different issuingentity. The access device network 106 can route transaction data to thedifferent access device networks if the access device network 106 andthe real credentials are not associated with the same entity.

Furthermore, access device network 106 may not be configured to transmitdata to an authorizing entity computer to which the access devicenetwork 106 is not associated. In some cases, the access device network106 may only provide data (e.g., transaction data, authorization requestmessages, etc.) to an associated authorizing entity computer, but notprovide data to not associated authorizing entity computers. This may bedue to a number of reasons, for example, the communications between theaccess device network 106 and the associated authorizing entity computermay be of unique formats and/or utilize specific cryptographic protocolssuch that a different access device network cannot communicate directlywith the authorizing entity computer.

The transport computer 110 can include a computer that, at least routesmessages between the access device 104 and a processing network computer112. The transport computer 110 can be operated by an acquirer, whichmay typically be a business entity (e.g., a commercial bank) that has abusiness relationship with a particular merchant or other entity.

The processing network computer 112 can include a server computer usedfor processing interaction data (e.g., transaction data, access data,etc.). In some embodiments, the processing network computer 112 may becoupled to a database and may include any hardware, software, otherlogic, or combination of the preceding for servicing the requests fromone or more client computers. The processing network computer 112 maycomprise one or more computational apparatuses and may use any of avariety of computing structures, arrangements, and compilations forservicing the requests from one or more client computers. In someembodiments, the processing network computer 112 may operate multipleserver computers. In such embodiments, each server computer may beconfigured to process transaction for a given region or handlestransactions of a specific type based on transaction data.

The processing network computer 112 may include data processingsubsystems, networks, and operations used to support and deliverauthorization services, exception file services, and clearing andsettlement services. An exemplary processing network computer 112 mayinclude VisaNet™. Networks that include VisaNet™ are able to processcredit card transactions, debit card transactions, and other types ofcommercial transactions. VisaNet™, in particular, includes an integratedpayments system (Integrated Payments system) which processesauthorization requests and a Base II system, which performs clearing andsettlement services. The processing network computer 112 may use anysuitable wired or wireless network, including the Internet.

The processing network computer 112 can be in operative communicationwith the token service computer 114. The processing network computer 112can provide access tokens to the token service computer 114. The tokenservice computer 114 can determine a real credential associated (e.g.,in a database) with the access token. The token service computer 114 canthen provide the real credential to the processing network computer 112.

FIG. 2 shows a block diagram of an access device 200 according toembodiments. The exemplary access device 200 may comprise a processor204. The processor 204 may be coupled to a memory 202, a networkinterface 206, input elements 210, output elements 212, and a computerreadable medium 208. The computer readable medium 208 can comprise acommunication module 208A and an authorizing entity computerdetermination module 208B.

The memory 202 can be used to store data and code. The memory 202 may becoupled to the processor 204 internally or externally (e.g., cloud baseddata storage), and may comprise any combination of volatile and/ornon-volatile memory, such as RAM, DRAM, ROM, flash, or any othersuitable memory device. For example, the memory 202 can store BINtables, routing tables, etc.

The one or more input elements 210 may include any suitable device(s)capable of inputting data into the access device 200. Examples of inputelements 210 include buttons, touchscreens, touch pads, microphones,etc.

The one or more output elements 212 may comprise any suitable device(s)that may output data. Examples of output elements 212 may includedisplay screens, speakers, and data transmission devices. For example,the output elements 212 can include a display screen capable ofdisplaying a response value to a user of the access device 200.

The computer readable medium 208 may comprise code, executable by theprocessor 204, for performing a method comprising: providing, by anaccess device to a user device associated with a user in a transaction,an initial communication, wherein the user device then retrieves a useridentifier and an access token from a memory in the user device;receiving, by the access device from the user device, the useridentifier and the access token; receiving, by the access device, asecret associated with the user; determining, by the access device,using the user identifier and/or the access token, if the transaction isauthorized by an authorizing entity computer associated with the accessdevice or by an authorizing entity not associated with the accessdevice; if the transaction is authorized by the authorizing entitycomputer associated with the access device, then transmitting anauthorization request message comprising the user identifier, thesecret, and the access token to the authorizing entity computer, whereinthe authorizing entity computer validates the secret, retrieves a realcredential of the user using the user identifier, and authorizes thetransaction; and if the transaction is not associated with theauthorizing entity computer, then transmitting the authorization requestmessage comprising the user identifier, the secret, and the access tokento a token service computer, wherein the token service computerdetokenizes the access token to obtain the real credential replaces theaccess token with the real credential in the authorization requestmessage to form a modified authorization request message, and forwardsthe modified authorization request message to another authorizing entitycomputer for authorization.

A communication module 208A may be configured or programmed to performsome or all of the functionality associated with receiving, sending, andgenerating electronic messages for transmission at the access device 200to or from any of the entities shown in FIGS. 1-7 (e.g., a user device,an access device network, a transport computer, etc.). When anelectronic message is received by the access device 200 via the networkinterface 206, it may be passed to the communication module 208A. Thecommunication module 208A may identify and parse the relevant data basedon a particular messaging protocol used in the access device 200 (e.g.,EMV 2.0, etc.). The communication module 208A may then transmit anyreceived information to an appropriate module within the access device200 (e.g., the authorizing entity computer determination module 208B).The communication module 208A may also receive information from one ormore of the modules in the access device 200 and generate an electronicmessage in an appropriate data format in conformance with a transmissionprotocol used in the access device 200 so that the message may be sentto one or more entities within the system. The electronic message maythen be passed to the network interface 206 for transmission.

The authorizing entity computer determination module 208B can includemay comprise code or software, executable by the processor 204, fordetermining an authorizing entity computer. The authorizing entitycomputer determination module 208B, in conjunction with the processor204, can determine, using a user identifier and/or an access token, if atransaction is authorized by an authorizing entity computer associatedwith the access device or by an authorizing entity not associated withthe access device.

The authorizing entity computer determination module 208B, inconjunction with the processor 204, can determine if a transaction isauthorized by an authorizing entity computer associated with the accessdevice 200 or by an authorizing entity not associated with the accessdevice 200 using a user identifier. For example, the authorizing entitycomputer determination module 208B, in conjunction with the processor204, can determine that a particular portion of digits (e.g., firstfour, last two, etc.) corresponds to a particular authorizing entitycomputer. For example, the authorizing entity computer determinationmodule 208B, in conjunction with the processor 204, can receive a useridentifier of 123456789. The authorizing entity computer determinationmodule 208B of the access device 200 can then, in conjunction with theprocessor 204, determine that the last two digits of 89 correspond to afirst authorizing entity computer. The last two digits of 89 can also,in some embodiments, also correspond to the access device 200.

The authorizing entity computer determination module 208B, inconjunction with the processor 204, can determine if a transaction isauthorized by an authorizing entity computer associated with the accessdevice 200 or by an authorizing entity not associated with the accessdevice 200 using an access token. For example, the access device canstore a token range table (e.g., a BIN range table). The authorizingentity computer determination module 208B can determine an authorizingentity computer based on an access token received from the user device.

As an illustrative example, the access token can be “0123456789012345.”The authorizing entity computer determination module 208B, inconjunction with the processor 204, can determine that the access tokenis included in a token range of, for example,0123456780000000-0123456790000000. Each token range can be associatedwith an authorizing entity computer.

The network interface 206 may include an interface that can allow theaccess device 200 to communicate with external computers. The networkinterface 206 may enable the access device 200 to communicate data toand from another device. Some examples of the network interface 206 mayinclude a modem, a physical network interface (such as an Ethernet cardor other Network Interface Card (NIC)), a virtual network interface, acommunications port, a Personal Computer Memory Card InternationalAssociation (PCMCIA) slot and card, or the like. The wireless protocolsenabled by the network interface 206 may include Wi-Fi™. Datatransferred via the network interface 206 may be in the form of signalswhich may be electrical, electromagnetic, optical, or any other signalcapable of being received by the external communications interface(collectively referred to as “electronic signals” or “electronicmessages”). These electronic messages that may comprise data orinstructions may be provided between the network interface 206 and otherdevices via a communications path or channel. As noted above, anysuitable communication path or channel may be used such as, forinstance, a wire or cable, fiber optics, a telephone line, a cellularlink, a radio frequency (RF) link, a WAN or LAN network, the Internet,or any other suitable medium.

III. Methods

A. Provisioning

FIG. 3 shows a flowchart of a provisioning method according toembodiments. The method illustrated in FIG. 3 will be described in thecontext of an authorizing entity provisioning a user device with a useridentifier. It is understood, however, that the invention can be appliedto other circumstances. Typically during a provisioning process, a userof a user device can select to input credentials (e.g., a PAN) into adigital wallet application on a user device. Upon receiving and storingthe credentials, the user device can request a token to associate withthe credentials from a processing network computer. After receiving thetoken request the processing network computer sends a provisioningrequest to the authorizing entity computer to request a user identifier.After receiving the user identifier, the processing network computer cansend the token to the user device.

The method illustrated in FIG. 3 includes an authorizing entity computer302 initiated provisioning process. At step 1, the authorizing entitycomputer 302 can initiate provisioning of a token and a user identifierto a user device 306. In some embodiments, the authorizing entitycomputer 302 can generate a user identifier. In other embodiments, theauthorizing entity computer 302 can retrieve an existing user identifierassociated with the user of the user device 306. The authorizing entitycomputer 302 can provide the user identifier to a processing networkcomputer 304. For example, the authorizing entity computer 302 canprovide a token provisioning request comprising the user identifier tothe processing network computer 304.

At step 2, after receiving the token provisioning request, theprocessing network computer 304 can create an access token associatedwith the user. The access token can be generated in any suitable manner.For example, in some embodiments, the access token can be generatedbased on user credentials (e.g., a PAN) associated with the user of theuser device 306. For example, the processing network computer 304 canreceive the user credentials from the authorizing entity computer 302 ormay have a database which stores user credentials and user identifiersassociated with the user credentials. In other embodiments, the accesstoken can be randomly generated and then assigned to (e.g., associatedwith) the user identifier and/or the user credentials. The processingnetwork computer 304 can then provide the access token into digitalwallet and/or database (e.g., a resource provider card-on-filedatabase). The access token can be provided from the processing networkcomputer 304 directly to the user device 306 and/or a digital walletstored on the user device 306.

In some embodiments, the processing network computer 304 can personalizethe access token. As an illustrative example, the followingpersonalization profiles can be associated with an access token asdepicted in Table 1, which describes values associated with the accesstoken, and Table 2, which describes potential detokenization options forthe access token.

A proprietary application identifier extension (PIX) and a registeredapplication provider identifier (RID) can be provided. A PIX can be avariable length suffix that may be allocated by card procedures todifferentiate between multiple applications (e.g., credit and debitapplications) provided by that procedure. The value of any PIX can beproprietary for each procedure, and if present can be appended to an RIDto create an application identifier (AID) of each application. The RIDcan be a fixed length unique identifier allocated to each card procedureto identify EMV applications provided by that procedure. The proceduresmay then suffix the RID with the PIX to further differentiate betweenmultiple products supported by the procedure, and together they form theAID. The AID can be used to uniquely identify each EMV (EuropayMastercard Visa) application that an access device supports, and an AIDcan have an associated card procedure and parameters relating to how theapplication needs to be processed. An access device may contain anynumber of such applications, and the list of each supported AID is usedduring a candidate list creation process to generate a list ofapplications that are mutually supported by both the terminal and thecard.

TABLE 1 Example global RID/PIX/AID values PIX Descrip- Establishment RID(suffix) AID tion Visa A000000003 1010xx A0000000031010xx Visa (Debit/Credit) A000000098 0840 A00000000980840 U.S. Common Debit ProprietaryA000000003 3010 A0000000033010xx Interlink ATM * A000000003 8010A0000000038010 Plus Proprietary * A000000003 8010 A0000000038010 Plus

TABLE 2 Detokenization Options Proposed ATM Issuer De- Routing to CallOut Token Token tokenization Establishment RID VTS supported ExchangeExchange Bypass Visa A000000003 Visa No Yes Yes Yes A000000098 Any USYes - POS Yes Yes No Debit POS only Network + N/A to ATM Visa ortransaction Plus Proprietary A000000003 Visa or No Yes Yes Yes ATM PlusInterlink No No No No Proprietary A000000003 Visa, Plus No Yes Yes YesInterlink No No No No

B. Authorization

FIG. 4 shows a flowchart illustrating an authorization process accordingto embodiments. The method illustrated in FIG. 4 will be described inthe context of a first user device performing an authorization processwith an access device (e.g., an on-us interaction), then a second userdeice performing an authorization process with the access device (e.g.,a not-on-us interaction). It is understood, however, that the inventioncan be applied to other circumstances (e.g., any suitable number of userdevices performing an authorization process with the access device inany order, etc.). In some embodiments, the authorization processdescribed in reference to FIG. 4 can be referred to as an on-usauthorization process.

In some cases, a user device can provide a token to the access device.Upon receiving the token, the access device can route the token to adetokenization computer (e.g., a token service computer). Detokenizationenables security within user controlled devices (e.g., the user device),and can facilitate the authorizing entity computer in determining whichaccount and/or real credentials are associated with the token.

Embodiments described in reference to FIG. 4 have various advantages.For example, the following process described in reference to FIG. 4 canbe efficient and can take less time to process a transaction, becausefewer steps (e.g., detokenization processes) are not performed.

Prior to step 420, the first user device 402 can receive an access tokenvia a provisioning process, for example, as described in reference toFIG. 3.

At step 420, an access device 404 can provide an initial communicationto a first user device 402 associated with a user in a transaction. Theinitial communication can be, for example, a select proximity paymentsystem environment (PPSE) command. The initial communication can, insome embodiments, allow the user device and the access device todetermine a processing environment for subsequent communications. ThePPSE commend and a PPSE response can be subsequently be followed by aget processing options command and response and a read record commandand response. However, it is understood, that the communications betweenthe access device 404 and the first user device 402 can include anysuitable communications. In some embodiments, the communications thatallow the access device 404 to retrieve data from the user device atand/or near the beginning of the process illustrated in FIG. 4 cancollectively be referred to as an initial communication. Further detailsregarding the initial communication are described in further detail inreference to FIG. 5.

The initial communication can be provided to the first user device 402upon the first user device 402 entering communication range with theaccess device 404. For example, the access device 404 can determine thatthe first user device 402 has entered short-range communication (e.g.,NFC, Bluetooth, BLE, etc.).

At step 422, after receiving the initial communication from the accessdevice 404, the first user device 402 can determine to provide a useridentifier and an access token to the access device 404. The first userdevice 402 can retrieve the user identifier and the access token from amemory of the first user device 402. The user identifier can be a userinformation file identifier, also referred to as a customer informationfile identifier (CIF ID). The access token can be a token thatcorresponds to a real credential of the user.

At step 424, the first user device 402 can provide the user identifierand the access token to the access device 404. In some embodiments, thefirst user device 402 can provide the user identifier and the accesstoken in the same response message or in different response messages(e.g., a first response message and a second response message). Thecommunications between the first user device 402 and the access device404 are discussed in further detail in regards to FIG. 5.

For example, the user identifier can be alphanumeric and may, in someembodiments, be unique to the user. For example, the user identifierprovided from the first user device 402 to the access device 404 can be“NU486F100A.” The access token can be a value of, for example,“0123456789123456.”

At step 426, after receiving the user identifier and the access tokenfrom the first user device 402, the access device 404 can furtherreceive a secret associated with the user. The access device 404 canprompt the user to input a secret (e.g., a PIN). For example, the accessdevice 404 can display a message to the user on a display screen of theaccess device 404. The message can indicate to the user to enter asecret into the access device 404 via one or more input elements of theaccess device 404.

In some embodiments, at any suitable time during steps 420-426 the usercan select one or more options displayed to the user on the accessdevice 404. For example, the user can select to perform a withdrawal,perform a deposit, review account history, perform a transaction, etc.As an illustrative example, the user can select to perform a withdrawal(e.g., to obtain currency) from the access device 404. The option toperform a withdrawal can be included in authorization request andauthorization response messages described below.

At step 428, the access device 404 can determine if the transaction isauthorized by an authorizing entity computer associated with the accessdevice or by an authorizing entity not associated with the access deviceusing the user identifier and/or the access token. An authorizing entitycomputer that is associated with the access device can be owned and/oroperated by the same entity. An authorizing entity that is notassociated with the access device may not be owned and/or operated bythe same entity. For example, the authorizing entity computer A 408 canbe an authorizing entity computer that is associated with the accessdevice. The authorizing entity computer B 414 can be an authorizingentity computer that is not associated with the access device 404.

For example, the access device 404 can determine, based on the accesstoken, if the transaction is authorized by 1) an authorizing entitycomputer associated with the access device or by 2) an authorizingentity computer not associated with the access device. For example, theaccess device 404 can determine to which BIN range the access tokenbelongs (e.g., numerically lies within). An access token can begenerated within a BIN range that has been associated with a particularauthorizing entity computer. The access device 404 can determine thatthe received access token lies within a BIN range that is associatedwith the authorizing entity that is further associated with the accessdevice. Similarly, the BIN range can be also associated with the accessdevice 404 itself. If the access device 404 determines that the accesstoken lies within the BIN range associated with the access device 404,then the access device 404 can determine that the transaction isauthorized by an authorizing entity computer associated with the accessdevice.

The access device 404 can store a BIN table that can be referenced todetermine which authorizing entity computer can authorize thetransaction with the received access token.

As an illustrative example, the access device 404 can evaluate thereceived access token of 0123456789123456. The access device 404 can beassociated with an authorizing entity computer (e.g., the authorizingentity computer A 408), where both devices correspond to a range of0123450000000000-0123459999999999. The access device 404 can determinethat the received access token of 0123456789123456 is a value that lieswithin the range of 0123450000000000-0123459999999999, and thendetermine that the access token is authorized by an authorizing entitycomputer associated with the access device 404.

At step 430, the access device 404 can generate an authorization requestmessage comprising the user identifier, the secret, and the accesstoken. If the transaction is authorized by the authorizing entitycomputer (the authorizing entity computer A 408) associated with theaccess device 404, then at step 430, the access device 404 can transmitthe authorization request message comprising the user identifier, thesecret, and the access token to an access device network 406.

At step 432, after receiving the authorization request message from theaccess device 404, the access device network 406 can provide theauthorization request message to the authorizing entity computer A 408.

At step 434, after receiving the authorization request message, theauthorizing entity computer A 408 can validate the secret. For example,the secret can be a PIN entered by the user directly into the accessdevice 404. The authorizing entity computer A 408 can compare thereceived PIN to a stored PIN (e.g., previously created by the user orassigned to the user). If the received PIN matches the stored PIN, thenthe authorizing entity computer A 408 can determine that the user isauthentic.

At step 436, the authorizing entity computer A 408 can retrieve a realcredential of the user using the user identifier. For example, theauthorizing entity computer A 408 can determine a user information file(e.g., a customer information file (CIF)) that is stored in relation toand/or comprises the user identifier. The user information file caninclude one or more real credentials. The authorizing entity computer A408 can determine at least one real credential based on the receiveduser identifier.

As an illustrative example, the authorizing entity computer A 408 candetermine that the received user identifier of NU486F100A is associatedwith a first user information file in the database. The first userinformation file can include the user identifier of NU486F100A. Thefirst user information file can include one or more account numbers thatcan be accessed by the user. For example, the first user informationfile can include a first account number of 0123455555123456 (which canbe the real credential), a second account number of 0123456888999999,and a third account number of 0123456777888999. The first userinformation file can include any suitable number of account numbers,where each account number can be for a same or a different type ofaccount including, but not limited to, a checking account, a savingsaccount, a money market account, a brokerage account, an investmentretirement account, and/or any other account which can be accessed bythe user.

In some embodiments, after determining and retrieving the realcredential of the user, the authorizing entity computer A 408 can linkthe real credential (e.g., a PAN) to the access token. For example, theauthorizing entity computer A 408 can store in an interaction log, orother suitable database, information regarding the interaction (e.g.,transaction). The authorizing entity computer A 408 can store the realcredential and the access token together in the log, such that at anysuitable point in time thereafter, an entity and/or device can determinethat the interaction was performed with the access token and the realcredential.

At step 438, the authorizing entity computer A 408 can determine whetheror not to authorize the transaction. The authorizing entity computer A408 can generate an indication of whether or not the transaction isauthorized. The authorizing entity computer A 408 can generate anauthorization response message comprising an indication of whether ornot the transaction is authorized. In some embodiments, the authorizingentity computer A 408 can include one or more account numbers to whichthe user has access to for the current interaction in the authorizationresponse message.

At step 440, the authorizing entity computer A 408 can provide theauthorization response message to the access device network 406.

At step 442, after receiving the authorization response message from theauthorizing entity computer A 408, the access device network 406 canprovide the authorization response message to the access device 404.

At step 444, after receiving the authorization response message, theaccess device 404 can determine whether or not transaction wasauthorized by the authorizing entity computer A 408. If the transactionis authorized, the access device 404 can display any suitableinformation to the user on the display of the access device 404. Forexample, the access device 404 can display one or more accounts and/oraccount options to the user. As another example, the access device 404can provide the user with currency and/or goods associated with thetransaction. As yet another example, the access device 404 can provideaccess to a secure building, a secure webpage, secure data, etc.

As an example, the access device 404 can display options relating to theuser's initial selection (e.g., perform a withdrawal). The access device404 can display one or more account's received from the authorizingentity computer A 408, from which the user can select to withdrawalcurrency. For example, in some embodiments, the user can select towithdrawal money from the account associated with the real credentialand the access token. In other embodiments, the user can select towithdrawal money from a displayed account that is not associated withthe real credential and the access token, but is accessible by the user.

After the first user device 402 performs a transaction with the accessdevice 404, a second user device 403 can perform a second transactionwith the access device 404.

At step 446, an access device 404 can provide an initial communicationto a second user device 403 associated with another user in atransaction. The transaction conducted using the first user device 404may be by a first user. The transaction conducting using the second userdevice 403 may be by a second user. In step 446, the initialcommunication can request a user identifier and an access token.

The initial communication can be provided to the second user device 403upon the second user device 403 entering communication range with theaccess device 404. For example, the access device 404 can determine thatthe second user device 403 has entered short-range communication (e.g.,NFC, Bluetooth, BLE, etc.).

At step 448, after receiving the initial communication from the accessdevice 404, the second user device 403 can determine to provide a useridentifier and an access token to the access device 404. The second userdevice 403 can retrieve the user identifier and the access token from amemory of the second user device 403. At step 450, the second userdevice 403 can provide the user identifier and the access token to theaccess device 404. In some embodiments, the second user device 403 canprovide the user identifier and the access token in the same responsemessage or in different response messages (e.g., a first responsemessage and a second response message).

At step 452, after receiving the user identifier and the access tokenfrom the second user device 403, the access device 404 can determine ifthe transaction is authorized by an authorizing entity computerassociated with the access device or by an authorizing entity notassociated with the access device using the user identifier and/or theaccess token. For example, the authorizing entity computer A 408 can bean authorizing entity computer that is associated with the accessdevice. The authorizing entity computer B 414 can be an authorizingentity computer that is not associated with the access device 404 (e.g.,not within the same common network as the authorizing entity computer).

The access device 404 can determine that the received access token isassociated with an authorizing entity not associated with the accessdevice. For example, the access device 404 can determine that thetransaction is authorized by an authorizing entity not associated withthe access device (e.g., the authorizing entity computer B 414).

In some embodiments, the access device 404 can further receive a secretassociated with the user. The access device 404 can prompt the user toinput a secret (e.g., a PIN). For example, the access device 404 candisplay a message to the user on a display screen of the access device404. The message can indicate to the user to enter a secret into theaccess device 404 via one or more input elements of the access device404.

At step 454, the access device 404 can generate an authorization requestmessage comprising the user identifier, the secret, and the accesstoken. Since the transaction is authorized by the authorizing entitycomputer B 414 that is not associated with the access device 404, thenthe access device 404 can transmit the authorization request messagecomprising the user identifier, the secret, and the access token to atransport computer 410.

At step 456, the transport computer 410 can provide the authorizationrequest message to a processing network computer 412.

At step 458, after receiving the authorization request message, theprocessing network computer 412 can determine a real credential (e.g., aPAN) associated with the access token. For example, the processingnetwork computer 412 can provide the access token to a token servicecomputer. The token service computer can determine, using a database, areal credential that is stored in association with the access token. Thetoken service computer can then provide the real credential to theprocessing network computer 412. The processing network computer 412 canthen modify the authorization request message to include the realcredential, while removing the access token.

At step 460, the processing network computer 412 can then provide theauthorization request message (e.g., the modified authorization requestmessage) to the authorizing entity computer B 414.

At step 462, after receiving the authorization request message, theauthorizing entity computer B 414 can determine whether or not toauthorize the transaction. For example, the authorizing entity computerB 414 can determine whether or not to authorize the transaction basedon, at least, the received real credential. The authorizing entitycomputer B 414 can generate an authorization response message comprisingan indication of whether or not the interaction is authorized and thereal credential. In some embodiments, the authorizing entity computer B414 can also verify the received secret, as described herein.

At step 464, the authorizing entity computer B 414 can then provide theauthorization response message to the processing network computer 412.

At step 466, after receiving the authorization response messagecomprising the indication of whether or not the interaction isauthorized and the real credential, the processing network computer 412can modify the authorization response message to replace the realcredential with the token.

At step 468, after modifying the authorization response message, theprocessing network computer 412 can then provide the authorizationresponse message (e.g., the modified authorization response message) tothe transport computer 410.

At step 470, after receiving the authorization response message, thetransport computer 410 can provide the authorization response message tothe access device 404.

At step 472, after receiving the authorization response message (e.g.,the modified authorization response message) from the transport computer410, the access device 404 can display the authorization responsemessage and/or the indication of whether or not the interaction isauthorized to the user of the second user device 403. For example, insome embodiments, if the interaction is authorized, then the accessdevice 404 may provide currency and/or goods to the user of the userdevice. In other embodiments, if the interaction is not authorized, thenthe access device 404 can display an “interaction declined” message tothe user. The access device 404 can then prompt the user to inputadditional credentials and/or user known secret with which to re-attemptthe transaction.

In some embodiments, the aforementioned authorization process canoptionally include detokenization by a token service computer. Forexample, during a closed loop or “on-us” transaction, an access tokencan be detokenized by a token service computer. By detokenizing theaccess token during a closed loop transaction, the real credentialutilized in the transaction can be provided to the authorizing entitycomputer for authorization. In some embodiments, during thedetokenization process, a cryptogram can be provided from the userdevice 402 to the access device 404. For example, the cryptogram can bea piece of obscured text such as encrypted text. A cryptogram may beformed by encrypting input data with an encryption key such as asymmetric encryption key. In some embodiments, a cryptogram isreversible so that the inputs that are used to form the cryptogram canbe obtained using the same symmetric key to perform a decryptionprocess. For example, a cryptogram may include a dCVV (dynamic cardverification value). The cryptogram can provide the system with furthersecurity benefits as the cryptogram can be generated based on thecurrent interaction between the user device 402 and the access device404.

The cryptogram can be generated in any suitable manner. For example, theinput to the cryptogram can include data elements including an accountidentifier such as primary account number, and a variable data elementsuch as a counter, a time of day, or interaction value. Such data may beincluded using an encryption process such as DES, triple DES, or AESusing any suitable encryption keys. The encryption keys may also be UDKsor unique derived keys, and may be generated based upon device specificinformation such as an account number, which may be encrypted using amaster derivation key (MDK). The cryptogram can be verified by anothercomputer such a remote computer by either decrypting the cryptogram toand verifying the decrypted contents with other data (e.g., an accountnumber stored on file), or by encrypting other inputs and then comparingthe encrypted result to the cryptogram.

After receiving the authorization request message further including thecryptogram from the access device 404 at step 406, the access devicenetwork 406 can determine that the token in the authorization requestmessage should be detokenized by the processing network computer 412.The access device network 406 can transmit the authorization requestmessage to the processing network computer 408. After receiving theauthorization request message, the processing network computer 408 candetermine a real credential (e.g., a PAN) associated with the accesstoken through one or more communications with a token service computer(not shown). After receiving the access token from the processingnetwork computer 408, the token service computer can determine a realcredential that is associated with the received access token. Forexample, the real credential can be stored in association with (e.g.,relation to) the access token in a secure token database (e.g., a tokenvault).

The token service computer can provide the real credential to theprocessing network computer 408. After receiving the real credentialfrom the token service computer, the processing network computer 408 canthen modify the authorization request message to include the realcredential.

In some embodiments, the processing network computer 408 can verify thecryptogram provided from the user device 402 to the access device 404.By verifying the cryptogram, the processing network computer 408 canauthenticate the user device 402, since only the user device 402 canprovide the correct cryptogram. Thus, by performing the optionaldetokenization process, the processing network computer 408 can providefor additional security benefits by authenticating the user device 402.

The processing network computer 412 can then provide the modifiedauthorization request message to the access device network 406 forauthorization. After the interaction is authorized, or not authorized,the system can perform a tokenization process, where the processingnetwork computer 412, in conjunction with the token server computer,determines the token based on the real credential and replaces the realcredential with the token in the authorization response message.

C. Communication Details

FIG. 5 shows a flowchart illustrating a device communication methodaccording to embodiments. The method illustrated in FIG. 5 will bedescribed in the context of an access device and a user devicecommunicating. It is understood, however, that the invention can beapplied to other circumstances.

At step S505, the access device 504 can perform application selectionwith the user device 502 to select an application for furtherprocessing. For example, the access device 504 may determine whichapplications are supported by both the user device 502 and the accessdevice 504. In some embodiments, when the access device 504 detects thepresence of the user device 502, the access device 504 may send anavailable applications request (which may be a “select command”) to theuser device 502 to request information on which payment applications(e.g., a list of AIDS) may be available at the user device 502. In someembodiments, the application selection command can be a PPSE command.

The user device 502 may respond by sending an available applicationsresponse back to access device 504. The available applications response(which may be a “select response”) may include a list of available AIDs(application identifiers).

The access device 504 can then select a suitable application from thelist of applications received in the available applications response(e.g., by selecting an AID from the available AIDs). The access device504 may also send an application selection message (which may be a “readrecord” or “select AID” command) with the selected AID to the userdevice 502.

The user device 502, upon receiving the select AID command, can send aresponse (e.g., a “read record response”) for transaction data to theaccess device 504, which may be needed to execute a transaction usingthe selected application/AID. The request may include a list oftransaction data identifiers, and the list can be in the form of aprocessing options data object list (PDOL).

At step S510, the access device 504 can initiate application processingwith the user device 502. For example, the access device 504 may requestthat the user device 502 indicate data (e.g., a list of files containingthe data) to be used for the selected application and the functionssupported. In some embodiments; the access device 504 may send a getprocessing options (GPO) command. The access device 504 may also providetransaction information to the user device 502 (e.g.; via the GPOcommand).

The user device 502, upon receiving the GPO command, can generatedynamic transaction processing information using at least some of thereceived transaction data, and send (via a “GPO response”) a set oftransaction processing information to the access device 504. Thetransaction processing information may include one or more applicationfile locators (AFLs) that can be used as file addresses by access device504 to read account data stored on user device 502. In some embodiments,in response to the GPO command, the user device 502 can retrieve an useridentifier (e.g., a CIF ID) from memory. The user device 502 can providethe user identifier to the access device in the GPO response. Forexample, the user identifier can be included in a tag 9F10, which caninclude issuer application data (IAD). The user identifier included inthe tag 9F10 can be of variable length up to, for example, 32 bytes.

At step S515, the access device 504 may read application data. Forexample, the access device 504 may send a “read record command” to theuser device 502 to read account data stored at the user device 502.

The user device 502 can send the account data to the access device 504(e.g., via a “read record response”). The account data may include, forexample, track-2 equivalent data (e.g., an account identifier and/orother payment credentials) and the cardholder name, and/or other accountrelated data that is accessible at the AFL location. In someembodiments, in response to the read record command, the user device 502can retrieve a token (e.g., an access token) from memory. The userdevice 502 can provide the token to the access device 504 in the readrecord response.

Embodiments of the disclosure have a number of advantages. For example,embodiments provide for on-us token processing for ATM transactions.Embodiments provide for efficient processing of token transactions whenan access device is associated with an authorizing entity computer thatauthorizes the transaction. For example, embodiments do not need toroute every authorization request message through a token servicecomputer. Embodiments allow for an authorizing entity computer toassociate determined real credentials with access tokens without theneed to detokenize access tokens at a token service computer during atransaction. Once determined, the real credentials can be used toconduct transactions. Embodiments of the invention also allow for theuser of a user device with an access token to conduct a transaction withan authorizing entity computer without using an out of networkdetokenization server. This saves multiple messages and communications,and therefore processing time.

Although the steps in the flowcharts and process flows described aboveare illustrated or described in a specific order, it is understood thatembodiments of the invention may include methods that have the steps indifferent orders. In addition, steps may be omitted or added and maystill be within embodiments of the invention.

Another embodiment includes a method comprising: receiving, by a userdevice associated with a user in a transaction from an access device, aninitial communication; retrieving, by the user device, a user identifierand an access token from a memory in the user device in response to theinitial communication; and providing, by the user device to the accessdevice, the user identifier and the access token, wherein the userprovides a secret to the access device, wherein the access devicedetermines, using the user identifier and/or the access token, if thetransaction is authorized by an authorizing entity computer associatedwith the access device or by an authorizing entity not associated withthe access device, and if the transaction is authorized by theauthorizing entity computer associated with the access device, then theaccess device transmits an authorization request message comprising theuser identifier, the secret, and the access token to the authorizingentity computer, wherein the authorizing entity computer validates thesecret, retrieves a real credential of the user using the useridentifier, and authorizes the transaction, and if the transaction isnot associated with the authorizing entity computer, then the accessdevice transmits the authorization request message comprising the useridentifier, the secret, and the access token to a token servicecomputer, wherein the token service computer detokenizes the accesstoken to obtain the real credential replaces the access token with thereal credential in the authorization request message to form a modifiedauthorization request message, and forwards the modified authorizationrequest message to another authorizing entity computer forauthorization.

Further, in some embodiments, the initial communication includes a getprocessing options command and a read record command, and whereinproviding the user identifier and the access token further comprises:providing, by the user device, a get processing options responsecomprising the user identifier in response to the get processing optionscommand; and providing, by the user device, a read record responsecomprising the access token in response to the read record command.

Any of the software components or functions described in thisapplication may be implemented as software code to be executed by aprocessor using any suitable computer language such as, for example,Java, C, C++, C#, Objective-C, Swift, or scripting language such as Perlor Python using, for example, conventional or object-orientedtechniques. The software code may be stored as a series of instructionsor commands on a computer readable medium for storage and/ortransmission, suitable media include random access memory (RAM), a readonly memory (ROM), a magnetic medium such as a hard-drive or a floppydisk, or an optical medium such as a compact disk (CD) or DVD (digitalversatile disk), flash memory, and the like. The computer readablemedium may be any combination of such storage or transmission devices.

Such programs may also be encoded and transmitted using carrier signalsadapted for transmission via wired, optical, and/or wireless networksconforming to a variety of protocols, including the Internet. As such, acomputer readable medium according to an embodiment of the presentinvention may be created using a data signal encoded with such programs.Computer readable media encoded with the program code may be packagedwith a compatible device or provided separately from other devices(e.g., via Internet download). Any such computer readable medium mayreside on or within a single computer product (e.g. a hard drive, a CD,or an entire computer system), and may be present on or within differentcomputer products within a system or network. A computer system mayinclude a monitor, printer, or other suitable display for providing anyof the results mentioned herein to a user.

The above description is illustrative and is not restrictive. Manyvariations of the invention will become apparent to those skilled in theart upon review of the disclosure. The scope of the invention should,therefore, be determined not with reference to the above description,but instead should be determined with reference to the pending claimsalong with their full scope or equivalents.

One or more features from any embodiment may be combined with one ormore features of any other embodiment without departing from the scopeof the invention.

As used herein, the use of “a,” “an,” or “the” is intended to mean “atleast one,” unless specifically indicated to the contrary.

What is claimed is:
 1. A method comprising: providing, by an accessdevice to a user device associated with a user in a transaction, aninitial communication; responsive to providing the initialcommunication, receiving, by the access device from the user device, auser identifier and an access token; receiving, by the access device, asecret associated with the user; determining, by the access device,using the user identifier and/or the access token, if the transaction isauthorized by an authorizing entity computer associated with the accessdevice or by an authorizing entity not associated with the accessdevice; if the transaction is authorized by the authorizing entitycomputer associated with the access device, then transmitting anauthorization request message comprising the user identifier, thesecret, and the access token to the authorizing entity computer, whereinthe authorizing entity computer validates the secret, retrieves a realcredential of the user using the user identifier, and authorizes thetransaction; and if the transaction is not associated with theauthorizing entity computer, then transmitting the authorization requestmessage comprising the user identifier, the secret, and the access tokento a token service computer, wherein the token service computerdetokenizes the access token to obtain the real credential replaces theaccess token with the real credential in the authorization requestmessage to form a modified authorization request message, and forwardsthe modified authorization request message to another authorizing entitycomputer for authorization.
 2. The method of claim 1, wherein the methodfurther comprises: receiving, by the access device, an authorizationresponse message comprising at least an indication of whether or not thetransaction is authorized from the authorizing entity computer; anddisplaying, by the access device, the indication of whether or not thetransaction is authorized on a display of the access device to the userof the user device.
 3. The method of claim 1, further comprising:prompting, by the access device, the user to input the secret via one ormore input elements on the access device.
 4. The method of claim 1,wherein if the transaction is authorized by the authorizing entitycomputer associated with the access device, the authorizing entitycomputer validates the access token using the real credential.
 5. Themethod of claim 1, wherein the user identifier identifies a userinformation file, wherein the secret is a personal identificationnumber, and wherein the real credential is a primary account number. 6.The method of claim 1, wherein the initial communication includes a getprocessing options command and a read record command.
 7. The method ofclaim 6, wherein receiving the user identifier and the access tokenfurther comprises: receiving, by the access device, a get processingoptions response comprising the user identifier in response to the getprocessing options command; and receiving, by the access device, a readrecord response comprising the access token in response to the readrecord command.
 8. The method of claim 1, wherein if the transaction isauthorized by the authorizing entity computer associated with the accessdevice, then transmitting the authorization request message comprisingthe user identifier, the secret, and the access token to the authorizingentity computer further comprises: transmitting, by the access device,the authorization request message comprising the user identifier, thesecret, and the access token to the authorizing entity computer via anaccess device network.
 9. The method of claim 1, wherein the tokenservice computer provisions the user device with the access token. 10.An access device comprising: a processor; and a non-transitorycomputer-readable medium coupled to the processor, the computer-readablemedium comprising code executable by the processor for implementing amethod comprising: providing, by the access device to a user deviceassociated with a user in a transaction, an initial communication;responsive to providing the initial communication, receiving, from theuser device, a user identifier and an access token; receiving a secretassociated with the user; determining using the user identifier and/orthe access token, if the transaction is authorized by an authorizingentity computer associated with the access device or by an authorizingentity not associated with the access device; if the transaction isauthorized by the authorizing entity computer associated with the accessdevice, then transmitting an authorization request message comprisingthe user identifier, the secret, and the access token to the authorizingentity computer, wherein the authorizing entity computer validates thesecret, retrieves a real credential of the user using the useridentifier, and authorizes the transaction; and if the transaction isnot associated with the authorizing entity computer, then transmittingthe authorization request message comprising the user identifier, thesecret, and the access token to a token service computer, wherein thetoken service computer detokenizes the access token to obtain the realcredential replaces the access token with the real credential in theauthorization request message to form a modified authorization requestmessage, and forwards the modified authorization request message toanother authorizing entity computer for authorization.
 11. The accessdevice of claim 10, wherein if the transaction is not associated withthe authorizing entity computer, the token service computer forwards amodified authorization response message to the access device via atransport computer.
 12. The access device of claim 11, wherein themethod further comprises: receiving, by the access device, the modifiedauthorization response message from the token service computer; anddisplaying, by the access device, an indication of whether or not thetransaction is authorized by the another authorizing entity computer ona display of the access device to the user of the user device.
 13. Theaccess device of claim 10, wherein if the transaction is authorized bythe authorizing entity computer associated with the access device, themethod further comprises: transmitting, by the access device, theauthorization request message to the token service computer via anaccess device network.
 14. The access device of claim 13, wherein theauthorizing entity computer generates an authorization response messagecomprising at least an indication of whether or not the transaction isauthorized and the real credential and provides the authorizationresponse message to the token service computer, wherein the tokenservice computer tokenizes the real credential to obtain the accesstoken, replaces the real credential with the access token to form amodified authorization response message, and forwards the modifiedauthorization response message to the access device, wherein the methodfurther comprises: receiving, by the access device, the authorizationresponse message; and displaying, by the access device, the indicationof whether or not the transaction is authorized by the authorizingentity computer on a display of the access device to the user of theuser device.
 15. The access device of claim 10, wherein the initialcommunication is provided to the user device via a short-rangecommunication channel.
 16. The access device of claim 10, wherein theuser device is a first user device and comprises a memory, thetransaction is a first transaction, the initial communication is a firstinitial communication, the user identifier is a first user identifier,the access token is a first access token, the memory is a first memory,the secret is a first secret, the authorization request message is afirst authorization request message, the modified authorization requestmessage is a first modified authorization request message, the realcredential is a first real credential, and wherein the method furthercomprises: providing, to a second user device associated with a seconduser in a second transaction, a second initial communication, whereinthe second user device then retrieves a second user identifier and asecond access token from a second memory in the second user device;receiving, by the access device from the second user device, the seconduser identifier and the second access token; receiving a second secretassociated with the second user; determining using the second useridentifier and/or the second access token, if the second transaction isauthorized by the authorizing entity computer associated with the accessdevice or by the authorizing entity not associated with the accessdevice; if the second transaction is authorized by the authorizingentity computer associated with the access device, then transmitting asecond authorization request message comprising the second useridentifier, the second secret, and the second access token to theauthorizing entity computer, wherein the authorizing entity computervalidates the second secret, retrieves a second real credential of thesecond user using the second user identifier, and authorizes the secondtransaction; and if the second transaction is not associated with theauthorizing entity computer, then transmitting the second authorizationrequest message comprising the second user identifier, the secondsecret, and the second access token to the token service computer,wherein the token service computer detokenizes the second access tokento obtain the second real credential, replaces the second access tokenwith the second real credential in the second authorization requestmessage to form a second modified authorization request message, andforwards the second modified authorization request message to theanother authorizing entity computer for authorization.
 17. The accessdevice of claim 10, wherein the transaction is a location accesstransaction, wherein if the location access transaction is authorized,the method further comprises: providing, by the access device, access toa location of the location access transaction to the user.
 18. Theaccess device of claim 10, wherein the transaction is a data accesstransaction, wherein if the data access transaction is authorized, themethod further comprises: providing, by the access device, datacorresponding to the data access transaction to the user device of theuser.